Read the docs
TI-2026-20077 Aliases CVE-2026-24892

openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling

Priority HIGH 73CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of changelog entries. Serialized changelog data derived from attacker-influenced application state is unserialized without restricting allowed classes. Although no current application endpoint was found to introduce PHP objects into this data path, the presence of an unrestricted unserialize() call constitutes a latent PHP object injection vulnerability. If future code changes, plugins, or refactors introduce object values into this path, the vulnerability could become immediately exploitable with severe impact, including potential remote code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00917 60th percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed openITCOCKPIT (openITCOCKPIT): 5.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openITCOCKPITopenITCOCKPITbefore 5.4.05.4.0Patch availableCNA
  • openITCOCKPIT VendoropenITCOCKPIT Affected before 5.4.0 Fixed in 5.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:*before 5.4.0VulnerableopenITCOCKPIT
  • cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:* Versions before 5.4.0 Vulnerable ·openITCOCKPIT

Remediation

  • Fix · CNA openITCOCKPIT (openITCOCKPIT) Fixed in 5.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24892

References

Exploit 1

Patch 1

Other 1

  • TI-2026-20076 openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection CVSS 3.1HIGH 7.5
  • TI-2023-03285 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit CVSS 3.1MEDIUM 4.6
  • TI-2023-03014 Race Condition within a Thread in it-novum/openitcockpit CVSS 3.1MEDIUM 4.4
  • TI-2020-08682 openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute… CVSS 3.1CRITICAL 9.8
  • TI-2019-11598 openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21. CVSS 3.0CRITICAL 9.8
  • TI-2019-11594 openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21. CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences